feat(permission): add YOLO mode to auto-approve all permission prompts

[mguttmann]

Summary

• Add YOLO mode that auto-approves all "ask" permission prompts (explicit "deny" rules are always respected)
• Support session-only and persistent (config.json) modes
• Configurable via UI, CLI flag (opencode --yolo), and env var (OPENCODE_YOLO=true)

Closes #11831

Changes

Backend

File	Description
yolo/index.ts	Yolo namespace: enable/disable/toggle with bus events
flag/flag.ts	OPENCODE_YOLO env var support
permission/next.ts	Auto-approve "ask" rules when YOLO is active
project/bootstrap.ts	Initialize YOLO on startup from config
config/config.ts	yolo: boolean config field
server/routes/config.ts	GET/POST /config/yolo endpoints

Frontend

File	Description
settings-general.tsx	YOLO section: session-only toggle, persistent toggle, CLI usage reference, danger warnings

SDK

• Regenerated with YOLO endpoints

Safety

• Explicit deny rules are always respected, even in YOLO mode
• Only "ask" rules are auto-approved
• Clear warnings in UI
• Session-only mode for temporary use

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Found a potentially related PR:

Related PR:

• feat: add --dangerously-skip-permissions flag #7137 - feat: add --dangerously-skip-permissions flag
  • feat: add --dangerously-skip-permissions flag #7137
  • This PR addresses a similar goal: bypassing permission prompts. While it uses a different approach (--dangerously-skip-permissions flag), it's tackling the same user problem of auto-approving permissions without manual interaction.

The current PR (#11833) takes a more refined approach with the YOLO mode that:

• Respects explicit "deny" rules (safer than the earlier approach)
• Supports session-only and persistent modes
• Provides UI configuration options

The other permission-related PRs (#5905, #5841, #8855) are about granular permission configurations for specific resource types, not auto-approval mechanisms, so they're not duplicates.

[mguttmann]

Thanks for finding the related PR!

Here's how this compares to #7137 (--dangerously-skip-permissions):

Feature	This PR (#11833)	PR #7137
Respects explicit deny rules	✅ Always enforced	❌ Skips everything
Session-only mode	✅ Resets on restart	❌ N/A
Persistent mode	✅ Saved to config.json	❌ CLI flag only
Settings UI	✅ Full section with warnings	❌ None
Env var support	✅ OPENCODE_YOLO=true	❌ N/A
CLI flag	✅ opencode --yolo	✅ --dangerously-skip-permissions
Safety warnings	✅ Prominent UI warnings	❌ None

Key safety improvement: This PR only auto-approves "ask" rules — explicit "deny" rules in the permission config are always respected, even in YOLO mode. This makes it significantly safer than a blanket skip-all approach.

This is a clean split from the closed #9972 — focused solely on YOLO mode (multi-account OAuth is in separate PR #11832).

[mguttmann]

[eleqtrizit]

I've been waiting anxiously for this. Can we merge soon :)